CVE-2026-98575 - Vulnerability Details

- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

frame->ccid.datalen is read directly from the USB response frame
and used, unchecked, as an index into frame->data[]. A malicious or
malfunctioning device can set this field to an arbitrary value,
causing the driver to read far outside the received buffer.

Bound ccid.datalen against the maximum possible ACR122 frame size
before using it. This replaces the existing datalen == 0 check,
since datalen < 2 already covers that case and additionally
rejects datalen == 1, which would still underflow the
"datalen - 2" offset used below.

Published: 2026-10-18

Score: 6.2 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s NFC PN533 driver, the field ccid.datalen from a USB response frame is read without bounds checking and used as an index into the frame data buffer. This out‑of‑bounds read allows a crafted response from a malicious NFC reader to leak kernel memory, giving an attacker information disclosure. The weakness is a classic buffer overread (CWE‑125) as identified in the CVE.

Affected Systems

The flaw resides in the Linux kernel’s nfc/pn533 driver. All kernel releases before the commit that added bounds checking on ccid.datalen are vulnerable. Any distribution incorporating the unpatched kernel is affected; there are no specific vendor or product version listings supplied.

Risk and Exploitability

The CVSS score of 6.2 classifies the problem as medium severity. The EPSS score of less than 1 % indicates a very low probability of exploitation at present. The vulnerability is not listed in CISA KEV. Exploitation requires an attacker to supply a crafted USB frame to a connected NFC reader, meaning physical access or a trusted local USB position is needed. The threat is therefore primarily local, leading to information disclosure to the host system.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9815c7cf22daceabfb919ddcd6f2c80e049c1fbc`	affected	< 8db3b1e012a8b25078dfa1efabe3d0cd2916dcba
`9815c7cf22daceabfb919ddcd6f2c80e049c1fbc`	affected	< 74b3fbc60907ee97e3af3249091f57351b53a6d6
`9815c7cf22daceabfb919ddcd6f2c80e049c1fbc`	affected	< 8a0f1bb790d964893db7fc59febda9a534db07b3
`9815c7cf22daceabfb919ddcd6f2c80e049c1fbc`	affected	< ea82b7576793219fa10a8b545f8338998b2a9ce2
`9815c7cf22daceabfb919ddcd6f2c80e049c1fbc`	affected	< 72b8b2126e854d6756a1aa4bdc66d7457b832294
`9815c7cf22daceabfb919ddcd6f2c80e049c1fbc`	affected	< e72cbedc4596e808d22dd2b9fff666ece76f8dd6
`9815c7cf22daceabfb919ddcd6f2c80e049c1fbc`	affected	< 2450a388367231fb7dd798538f393af227c00c4d
`9815c7cf22daceabfb919ddcd6f2c80e049c1fbc`	affected	< b61732f47316d45f27706db7812950145d3327b5

Linux

affected

Version	Status	Constraints
`4.7`	affected	—
`0`	unaffected	< 4.7
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,8db3b1e012a8b25078dfa1efabe3d0cd2916dcba)`	affected	code_commit	—
`[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,74b3fbc60907ee97e3af3249091f57351b53a6d6)`	affected	code_commit	—
`[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,8a0f1bb790d964893db7fc59febda9a534db07b3)`	affected	code_commit	—
`[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,ea82b7576793219fa10a8b545f8338998b2a9ce2)`	affected	code_commit	—
`[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,72b8b2126e854d6756a1aa4bdc66d7457b832294)`	affected	code_commit	—
`[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,e72cbedc4596e808d22dd2b9fff666ece76f8dd6)`	affected	code_commit	—
`[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,2450a388367231fb7dd798538f393af227c00c4d)`	affected	code_commit	—
`[9815c7cf22daceabfb919ddcd6f2c80e049c1fbc,b61732f47316d45f27706db7812950145d3327b5)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.7`	affected	generic	—
`[0,4.7)`	unaffected	generic	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the patch adding bounds checking on ccid.datalen (e.g., commit 2450a388367231fb7dd798538f393af227c00c4d).
If an immediate update is not possible, unload or blacklist the nfc/pn533 driver (modprobe -r nfc/pn533) and physically disconnect any NFC reader devices to stop the vulnerable interaction.
Enforce device‑level isolation by restricting USB device permissions to trusted users and applying policies that prevent unauthorized hardware from being attached to the host.

Generated by OpenCVE AI on October 20, 2026 at 19:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00216.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98575.mbox
https://git.kernel.org/stable/c/2450a388367231fb7dd798538f393af227c00c4d
https://git.kernel.org/stable/c/72b8b2126e854d6756a1aa4bdc66d7457b832294
https://git.kernel.org/stable/c/74b3fbc60907ee97e3af3249091f57351b53a6d6
https://git.kernel.org/stable/c/8a0f1bb790d964893db7fc59febda9a534db07b3
https://git.kernel.org/stable/c/8db3b1e012a8b25078dfa1efabe3d0cd2916dcba
https://git.kernel.org/stable/c/b61732f47316d45f27706db7812950145d3327b5
https://git.kernel.org/stable/c/e72cbedc4596e808d22dd2b9fff666ece76f8dd6
https://git.kernel.org/stable/c/ea82b7576793219fa10a8b545f8338998b2a9ce2
https://nvd.nist.gov/vuln/detail/CVE-2026-98575
https://www.cve.org/CVERecord?id=CVE-2026-98575

History

Tue, 20 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98575.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98575 https://www.cve.org/CVERecord?id=CVE-2026-98575
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() frame->ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame->data[]. A malicious or malfunctioning device can set this field to an arbitrary value, causing the driver to read far outside the received buffer. Bound ccid.datalen against the maximum possible ACR122 frame size before using it. This replaces the existing datalen == 0 check, since datalen < 2 already covers that case and additionally rejects datalen == 1, which would still underflow the "datalen - 2" offset used below.
Title		nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2450a388367231fb7dd798538f393af227c00c4d https://git.kernel.org/stable/c/72b8b2126e854d6756a1aa4bdc66d7457b832294 https://git.kernel.org/stable/c/74b3fbc60907ee97e3af3249091f57351b53a6d6 https://git.kernel.org/stable/c/8a0f1bb790d964893db7fc59febda9a534db07b3 https://git.kernel.org/stable/c/8db3b1e012a8b25078dfa1efabe3d0cd2916dcba https://git.kernel.org/stable/c/b61732f47316d45f27706db7812950145d3327b5 https://git.kernel.org/stable/c/e72cbedc4596e808d22dd2b9fff666ece76f8dd6 https://git.kernel.org/stable/c/ea82b7576793219fa10a8b545f8338998b2a9ce2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:18:40.577Z

Updated: 2026-10-19T09:22:00.641Z

Reserved: 2026-09-25T10:25:14.358Z

Link: CVE-2026-98575

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:09.810

Modified: 2026-10-19T10:19:16.573

Link: CVE-2026-98575

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98575 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T20:00:15Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object